What PicnicPal knows about you

A cookie. When you tap your name on a picnic, the browser gets a cookie that says which row on that picnic is yours. That is the whole of your identity: no email, no password, no account. A second device is a stranger until you tap your name there too.

The organizer has a similar cookie, which is how their own picnics list works. Clear your cookies and the app stops recognising you; your answers stay on the picnic under your name.

The join form asks where you set out from, and it is used for one thing: working out how long each option would take you, so a spot that is ten minutes for one person and ninety for another says so before anyone has to.

Other people on the picnic see your first name, the rough area you gave, and your drive time. They do not see your street address. Neither does the organizer.

Anyone holding a picnic's link can open it and see the picnic: who is in, the places, what people preferred, the discussion and the decision. That is the trade the product makes so nobody has to sign up. Share the link the way you would share the plan.

The crew page works the same way: any picnic link opens the history of that group of picnics.

Leave a picnic and your row is hidden everywhere: your preferences stop counting, your proposals leave the table with you, and the group stops waiting on you. Nothing of yours is shown again unless you come back.

The organizer can remove someone, and can undo it. Someone the organizer removed cannot put themselves back; someone who left of their own accord can.

Optional, and per device. If you turn nudges on, the browser gives us an address to send notifications to, and that is stored against the picnic. Turn them off in the app, or in the browser's own settings, and it is deleted. No account is involved, and nothing is shared with anyone.

Google, for the places, drive times, opening hours and photos of the spots. Google Gemini, to read the group's stated preferences and write the reason under each option. Open-Meteo, for the forecast on the proposed day. Vercel hosts the app and Turso stores the database, both in the United States.

The place searches send coordinates, not names. Nobody is sold anything, and there is no advertising. The only analytics is the traffic count described next, and it does not follow you across sites.

The production site uses Google Analytics 4 to know how many people plan picnics here. It loads only on picnicpal.vercel.app — never on preview links or local development — and it stays off entirely if your browser sends Do Not Track or Global Privacy Control.

Google's Consent Mode starts in the "denied" state: no analytics cookie is set and no banner asks you to accept one. Google may receive cookieless measurement pings without a stored identifier, and no advertising signals are enabled.

Every page view we send is fired manually and sanitized to the site origin, the page path and the page title. Address query strings and fragments — which on PicnicPal can carry picnic and invite slugs — are removed before anything is transmitted. Google's own processing follows its privacy policy.

A picnic and everything on it stays until it is deleted. Deleting one removes the places, the votes, the discussion, the decision, the photos, and the profile each person filled in for it — the name, the address and the coordinates go too, because they were only ever about that picnic. Write to us with the link and say you want it gone.

The app asks whether you are bringing children, and how old, because it changes what gets recommended — a playground matters if you have a four-year-old. That is a count and an age on the picnic, entered by the adult joining. It is not an account for a child and we do not ask for their names.